Privacy risk of booting on an ID'd device

offline-unread

I saw this guide to getting setting up a new private phone (Mental Outlaw) https://discuss.grapheneos.org/reset/izaZiaLf3IRXLH1hEQpTgEU2x60xwRCVbenjUICe - and he says not to boot the new phone with OS on an Apple or Windows device as they are sending back user data of all devices.

If I have a used cash-purchased device is this a legit risk which would potentially negate my privacy to a serious threat model? I don't use a sim on the new device.

n3t_admin

offline-unread what guide? The link you provided goes nowhere.

23Sha-ger

Sending what data and to who? The OS doesn't even have access to any data on the phone. What's more, if you purchased a device there is no data on it. If you bought a second hand one, just factory reset it. This is another tinfoil conspiracy.

offline-unread

@n3t_admin Sorry here's the proper link https://youtu.be/XaHWcttD0tM?si=8ee4FqwV_8dJ2LvI.

@23Sha-ger I think he was referring to the laptop or desktop collecting data about a new device appearing. In this case a new mobile (IMEI) that is associated then with the owner of the laptop.

23Sha-ger

offline-unread
The OS doesn't have access to any hardware information like IMEI just by connecting the phone via USB.
Your IMEI is only sent once to Google during the bootloader unlock process. If you don't want them to have
your IP address, do it over a public WiFi or a router with a VPN.

Windows and macOS do collect some telemetry, but not to the extent of connected devices serials.
Any person that claims such theories should be ignored and considered a conspiracy clown.

telemetry83

23Sha-ger

Stop spreading misinformation. Windows does collect serial numbers and other uniquely identifying information as part of their RBS files. "Forensic analysis of the Windows telemetry for diagnostics" is one study that clearly proves that: https://arxiv.org/abs/2002.12506.

Even in the case where an existing GrapheneOS device is used to install GrapheneOS on a new device, the existing GrapheneOS device will also record the new device's serial number. This has been confirmed by the GrapheneOS team: https://discuss.grapheneos.org/d/9954-usb-traces-left-on-device-used-to-install-graphene-from. Obviously, GrapheneOS does not send the information remotely as part of telemetry. It is only stored locally. That only applies to the phone OS. Keep in mind that any installed Android app can also read USB information and transit it remotely.

If you want to install privately, you should use a trustworthy device and OS in a new state. You should then factory reset that trustworthy device afterwards.

MEGAbyter

Not only does its own data get sent, its wifi and buetooth can detect and send info on other devices in the area and conversely, its signals and info can also seen by other local devices which can then be sent to whatever companies make those devices.

I setup GrapheneOS for lots of my friends and family members. Whenever I do, I ALWAYS do the initial wifi connection to turn on OEM unlock on public wifi networks and also use a burner Pixel with GrapheneOS installed on it to actually do the install, but I do that using that using the burner's own data tunneled through Mullvad VPN. And I do this with my own personal device turned off and in a faraday bag. For the friends that prefer to use burner accounts, I set those up out in the field also.

It seems excessive, but it's the only way to really be sure that no important telemetry data is received by and/or sent to any of the big tech companies.

23Sha-ger

telemetry83
Do you know the difference between collecting serial numbers of the current hardware windows is running on, and the serial numbers of hardware connected via USB?
In that case, share with us proof how to achieve it without connecting something like adb.
Even for that, the phone will have to authorize that pairing request.

telemetry83 This has been confirmed by the GrapheneOS team

What has been confirmed exactly? Do you know the difference between logs and actually uploading them without consent to Microsoft? Or do you believe Microsoft and Apple upload all user logs to their servers?

telemetry83 Keep in mind that any installed Android app can also read USB information and transit it remotely.

Proof needed. If that was the case (it's not), the entire Android security model would be broken.
Since we are talking about unlocking a freshly wiped device, this also rules out potential malicious app being
previously installed.

telemetry83 If you want to install privately, you should use a trustworthy device and OS in a new state. You should then factory reset that trustworthy device afterwards.

Wrong again. You can use any device, even compromised, attestation and boot keys are there to show you the integrity of the installation. There is no way to guarantee a "trustworthy" device, without verifying keys and using Auditor.

telemetry83

23Sha-ger

I don't know why I'm wasting my time.

23Sha-ger Do you know the difference between collecting serial numbers of the current hardware windows is running on, and the serial numbers of hardware connected via USB?

Read the PDF for the research paper I linked to.

23Sha-ger In that case, share with us proof how to achieve it without connecting something like adb.
Even for that, the phone will have to authorize that pairing request.

It doesn't require a pairing request. Even in Charging-only USB-C mode, identifiers are visible to a host operating system: https://discuss.grapheneos.org/d/11881-serial-number-visible-in-windows.

23Sha-ger What has been confirmed exactly?

Read the citation I originally provided: https://discuss.grapheneos.org/d/9954-usb-traces-left-on-device-used-to-install-graphene-from:

The device's serial number will be recorded in USB logs each device it's attached. Perform the install from another Android device and factory reset afterwards if you want a strong guarantee. It's a very niche property you want to achieve. Simply attaching it to charge would be no different.

23Sha-ger Do you know the difference between logs and actually uploading them without consent to Microsoft? Or do you believe Microsoft and Apple upload all user logs to their servers?

Nowhere in my post did I mention anything about Microsoft or Apple logs. I only mentioned GrapheneOS logs of a host GrapheneOS device during an installation.

23Sha-ger Proof needed. If that was the case (it's not), the entire Android security model would be broken.

I guess Android's own documentation breaks the entire Android security model!

General overview: https://developer.android.com/develop/connectivity/usb
API overview: https://developer.android.com/reference/android/hardware/usb/package-summary
How to enumerate all devices: https://developer.android.com/reference/android/hardware/usb/UsbManager#getDeviceList()
How to access unique identifiers such as serial number: https://developer.android.com/reference/android/hardware/usb/UsbDevice

23Sha-ger Wrong again. You can use any device, even compromised, attestation and boot keys are there to show you the integrity of the installation. There is no way to guarantee a "trustworthy" device, without verifying keys and using Auditor.

This entire thread has to do with privacy, not security. No one is talking about securely installing GrapheneOS. We're talking about privately installing GrapheneOS.

Notice how I keep providing citations for my statements, but you provide none. Can you provide citations for your statements?